CVE-2026-44844: medium-severity vulnerability in GOVCERT-LU eml_parser
eml_parser: Recursion DoS via nested message/rfc822 attachments
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.4%
eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.1, EmlParser.get_raw_body_text() recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly crafted EML file with approximately 120 nested message/rfc822 parts triggers an unhandled RecursionError and aborts parsing of the message. A 12 KB EML file is enough to crash a worker. Though this causes the parser to crash, it is an unlikely scenario as the suggested EML that crashes the parser would not pass basic RFC compliance tests. This vulnerability is fixed in 3.0.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
GOVCERT-LU · eml_parserRelated CVEs — GOVCERT-LU eml_parser
In the same product, most dangerous first.
CVE-2026-55620HIGHeml_parser: DoS via deeply nested parens in Received headersEPSS 0.6%CVE-2026-55619MEDIUMeml_parser: Parser DoS via deeply nested parentheses in e-mail headersEPSS 0.5%CVE-2026-55618MEDIUMeml_parser: URL extraction bypass via HTML entities in URLsEPSS 0.5%CVE-2026-29780MEDIUMeml_parser: Path Traversal in Official Example Script Leading to Arbitrary File WriteEPSS 0.3%